PHP Object Injection Vulnerability in Concrete CMS by Concrete5
CVE-2026-7888

8.4HIGH

Key Information:

Vendor

Concrete Cms

Status
Concrete Cms
Vendor
CVE Published:
3 June 2026

What is CVE-2026-7888?

Concrete CMS versions earlier than 9.5.2 are vulnerable to a PHP Object Injection flaw. This occurs through unserialize() calls in specific components like Workflow, Form block, and File/Set, which do not enforce the allowed_classes restriction. Attackers could exploit this vulnerability by inserting a malicious serialized payload into the database, leading to arbitrary PHP object instantiation. This raises significant security concerns for sites using affected versions of Concrete CMS. It is advised for users to upgrade to the latest version to mitigate these risks.

Affected Version(s)

Concrete CMS 5.0 < 9.5.2

References

https://documentation.concretecms.org/9-x/developers/intr...
release-notes

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

XananasX7
Sanjorn Keeratirungsan (dizconnect)
.